Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <ef91d500-60e8-fdfd-b661-161e7f2b12a3@perex.cz>
Date:   Mon, 9 Jan 2023 14:36:00 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: Re: [PATCH linux-next] ALSA: control-led: use strscpy() to instead of
 strncpy()
Content-Language: en-US
To:     Takashi Iwai <tiwai@suse.de>, yang.yang29@zte.com.cn
Cc:     tiwai@suse.com, alsa-devel@alsa-project.org,
        linux-kernel@vger.kernel.org, xu.panda@zte.com.cn
References: <202301091945513559977@zte.com.cn> <87zgarg9ul.wl-tiwai@suse.de>
From:   Jaroslav Kysela <perex@perex.cz>
In-Reply-To: <87zgarg9ul.wl-tiwai@suse.de>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 09. 01. 23 13:40, Takashi Iwai wrote:
> On Mon, 09 Jan 2023 12:45:51 +0100,
> <yang.yang29@zte.com.cn> wrote:
>>
>> From: Xu Panda <xu.panda@zte.com.cn>
>>
>> The implementation of strscpy() is more robust and safer.
>> That's now the recommended way to copy NUL-terminated strings.
>>
>> Signed-off-by: Xu Panda <xu.panda@zte.com.cn>
>> Signed-off-by: Yang Yang <yang.yang29@zte.com.cn>
>> ---
>>   sound/core/control_led.c | 3 +--
>>   1 file changed, 1 insertion(+), 2 deletions(-)
>>
>> diff --git a/sound/core/control_led.c b/sound/core/control_led.c
>> index f975cc85772b..c88653c205eb 100644
>> --- a/sound/core/control_led.c
>> +++ b/sound/core/control_led.c
>> @@ -534,8 +534,7 @@ static ssize_t set_led_id(struct snd_ctl_led_card *led_card, const char *buf, si
>>   	struct snd_ctl_elem_id id;
>>   	int err;
>>
>> -	strncpy(buf2, buf, len);
>> -	buf2[len] = '\0';
>> +	strncpy(buf2, buf, len + 1);
> 
> Still using strncpy()...?

The original code should be:

diff --git a/sound/core/control_led.c b/sound/core/control_led.c
index f975cc85772b..b44abefcb593 100644
--- a/sound/core/control_led.c
+++ b/sound/core/control_led.c
@@ -530,7 +530,7 @@ static ssize_t set_led_id(struct snd_ctl_led_card 
*led_card, const char *buf, si
                           bool attach)
  {
         char buf2[256], *s, *os;
-       size_t len = max(sizeof(s) - 1, count);
+       size_t len = min(sizeof(buf2) - 1, count);
         struct snd_ctl_elem_id id;
         int err;

But it can be replaced with:

diff --git a/sound/core/control_led.c b/sound/core/control_led.c
index f975cc85772b..41d4e898d34c 100644
--- a/sound/core/control_led.c
+++ b/sound/core/control_led.c
@@ -530,12 +530,11 @@ static ssize_t set_led_id(struct snd_ctl_led_card 
*led_card, const char *buf, si
                           bool attach)
  {
         char buf2[256], *s, *os;
-       size_t len = max(sizeof(s) - 1, count);
         struct snd_ctl_elem_id id;
         int err;

-       strncpy(buf2, buf, len);
-       buf2[len] = '\0';
+       if (strscpy(buf2, buf, count) < 0)
+               return -E2BIG;
         memset(&id, 0, sizeof(id));
         id.iface = SNDRV_CTL_ELEM_IFACE_MIXER;
         s = buf2;

I'll send a patch ASAP.

				Jaroslav

--
Jaroslav Kysela <perex@perex.cz>
Linux Sound Maintainer; ALSA Project; Red Hat, Inc.